MCP SDK Tier Audit: modelcontextprotocol/typescript-sdk

Date: 2026-08-18
Branch: main (commit a81ef34ac)
Version: 2.0.0 — @modelcontextprotocol/client@2.0.0, @modelcontextprotocol/server@2.0.0, core, server-legacy, codemod, node, express, hono, fastify (all published 2026-07-27T23:55Z, npm latest); v1 maintenance line at 1.30.0
Requested tier: Tier 1
Requirements revisions scored: 2025-11-25 and 2026-07-28 — frozen requirement sets, each run at that revision's own wire version
Tool: @modelcontextprotocol/conformance tier-check 0.2.0-alpha.11 (+ #458; conformance main @ 74edef3), driven by the mcp-sdk-tier-audit skill
Previous assessment: #2271 (Tier 1, v1.27.0, 2026-02-18)

Tier Assessment: Tier 1

The TypeScript SDK meets all Tier 1 requirements: 100% scored conformance on both sides at both frozen revisions (server 30/30 @ 2025-11-25 and 37/37 @ 2026-07-28; client 18/18 and 32/32), 100% issue triage within SLA, no open P0s, stable releases on both the v2 (2.0.0) and v1.x (1.30.0) lines shipped the day before the 2026-07-28 spec, 48/48 documented features with examples, and published dependency, roadmap and versioning policies. The only failing scenarios are extension-tagged and unscored (SEP-2663 tasks on the server; SEP-1932 DPoP / SEP-1933 WIF on the client), all captured in the SDK's own expected-failures.yaml.

Requirements Summary

Policy-signal files as detected by the CLI (checks.policy_signals, status partial because the optional alternates are absent): present — SECURITY.md, CONTRIBUTING.md, DEPENDENCY_POLICY.md, .github/dependabot.yml, ROADMAP.md, VERSIONING.md; absent — CHANGELOG.md (root; per-package changelogs exist), docs/dependency-policy.md, .github/renovate.json, renovate.json, docs/roadmap.md, docs/versioning.md, BREAKING_CHANGES.md. The partial status is informational; requirements 6-8 are judged on content in the Policy Evaluation section below.

Tier Determination

• Tier 1: PASS -- 8/8 requirements met (failing: none)
• Tier 2: PASS -- 7/7 requirements met (failing: none)
• Final Tier: 1

Conformance

The SDK's own conformance workflow runs the same legs on every push to main (pinned referee 0.2.0-alpha.11, test/conformance/package.json). The server invocation comes from the typescript-sdk entry in src/sdk-runner/known-sdks.ts; one process serves both revisions.

Only scored rows with a date-versioned specVersions tag are counted. A scenario tagged with several spec versions counts in each of those columns; "All" is the number of unique scored rows for that run.

Run @ 2025-11-25 (frozen 2025-11-25 requirement set)

Run @ 2026-07-28 (frozen 2026-07-28 requirement set)

Informational, not scored: server extension 0/10 @ 2026-07-28 (all tasks-*); client extension 3/6 per revision (auth/dpop, auth/dpop-nonce, auth/wif-jwt-bearer fail; auth/enterprise-managed-authorization, auth/client-credentials-jwt, auth/client-credentials-basic pass); every added-after-release and pending row passes.

Server Conformance Details

Pass rate: 100% (67/67 scored rows across both revisions; 47 unique scored scenarios; 83 rows including not-scored)

Revision 2025-11-25 (wire 2025-11-25, frozen 2025-11-25 requirement set)

Scored: 30/30 (100%), 70/70 checks. Not scored: 3 rows (3 pass, 0 fail).

Revision 2026-07-28 (wire 2026-07-28, frozen 2026-07-28 requirement set)

Scored: 37/37 (100%), 119/119 checks. Not scored: 13 rows (3 pass, 10 fail).

Client Conformance Details

Full suite pass rate: 100% (50/50 scored rows across both revisions; 35 unique scored scenarios; 64 rows including not-scored)

Suite breakdown: @ 2025-11-25 — Core 4/4 (100%), Auth 14/14 (100%); @ 2026-07-28 — Core 7/7 (100%), Auth 25/25 (100%). Category rule: auth/ prefix = Auth, everything else = Core.
Baseline: 3 known expected failures documented in test/conformance/expected-failures.yaml:38-40 (auth/dpop, auth/dpop-nonce, auth/wif-jwt-bearer — extension-tagged SEP-1932 DPoP / SEP-1933 WIF scenarios); the 2026-07-28 leg baseline test/conformance/expected-failures.2026-07-28.yaml:35 (client: []) is empty. All 6 not-scored client failures below (3 per revision) are exactly these baseline entries; there are no unexpected failures.

Core Scenarios

Revision 2025-11-25

Scored: 4/4 (100%), 11/11 checks. Not scored: 1 (1 pass, 0 fail).

Revision 2026-07-28

Scored: 7/7 (100%), 54/54 checks. Not scored: 1 (1 pass, 0 fail).

Auth Scenarios

Revision 2025-11-25

Scored: 14/14 (100%), 216/216 checks. Not scored: 6 (3 pass, 3 fail).

Revision 2026-07-28

Scored: 25/25 (100%), 322/322 checks. Not scored: 6 (3 pass, 3 fail).

Issue Triage Details

Analysis period: Last 289 issues (checks.triage.total_issues)
Labels: 12/12 present — bug, enhancement, question, needs confirmation, needs repro, ready for work, good first issue, help wanted, P0, P1, P2, P3; missing: none (checks.labels.missing = [], uses_issue_types: false)

No open P0s (checks.p0_resolution.open_p0_details = []).

Documentation Coverage

48/48 non-experimental features documented with examples (36/36 core), on the v2 guide site ts.sdk.modelcontextprotocol.io/v2/ (source: docs/; every code fence is synced from an executed example under examples/guides/) plus examples/. Experimental Tasks (SEP-2663) are not implemented in v2 and are excluded.

Policy Evaluation

Changes Since the Tier 1 Assessment (#2271)

cc @pcarleton @localden — since I lead the SDK WG, could one of you be the approving reviewer, as with #2271/#2307?

Reproduce This Assessment

# Conformance repo at 0.2.0-alpha.11 + #458
git clone https://github.com/modelcontextprotocol/conformance.git
cd conformance
git checkout 74edef3
npm install
npm run build

# GitHub API access for repo-health checks
gh auth login
export GITHUB_TOKEN=$(gh auth token)

# tier-check builds the SDK (pnpm install && pnpm run build:all) and starts the
# everything server per the typescript-sdk entry in src/sdk-runner/known-sdks.ts.
node dist/index.js tier-check \
  --sdk-path /path/to/typescript-sdk \
  --requirements 2025-11-25,2026-07-28 \
  --output markdown